The vulnerability exists in the pam_passkey_child_read_data() function of the SSSD PAM passkey responder on Red Hat Enterprise Linux 10. It improperly processes raw bytes from a pipe as a NUL-terminated C string without ensuring explicit termination, causing out-of-bounds reads during string operations like snprintf(). A local attacker with limited privileges can trigger this by sending a crafted passkey authentication request, causing the SSSD PAM responder to crash and resulting in a local denial of service. The CVSS 3.1 base score is 5.5 (medium severity) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The impact is a local denial of service caused by a crash of the SSSD PAM responder due to out-of-bounds reads triggered by crafted input. There is no impact on confidentiality or integrity. The vulnerability requires local access with low privileges and does not require user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6245 for current remediation guidance. Until an official fix is available, consider restricting local access to systems running Red Hat Enterprise Linux 10 and monitor for unusual authentication failures related to SSSD. No vendor advisory content explicitly states that no action is required or that the issue is already mitigated.